General

  • Target

    a4d257c892f85dfc1d475cfc9c1029e0d65ceba6da70038707e5bd0041580d6d

  • Size

    263KB

  • Sample

    221119-t4v9dsee9w

  • MD5

    4568b1dd6e36abce88bf98d024fb4380

  • SHA1

    1ce19a53caa0c37532d4e5beb06b3ebdf849efe1

  • SHA256

    a4d257c892f85dfc1d475cfc9c1029e0d65ceba6da70038707e5bd0041580d6d

  • SHA512

    992b3573997e871a694bac7ca570dc41eb924fad2184af220993baa849266f8bb97b748891cacabdd0afa1064bb63d17f683af3dc724f7aa151fce5382b082da

  • SSDEEP

    6144:Yp4nIghWPzAM6QgETd7z/ZnfdmRYHtFMeLSNwqdbsffd5Mc:YU27V5f4uHnMeIdIff8c

Malware Config

Targets

    • Target

      a4d257c892f85dfc1d475cfc9c1029e0d65ceba6da70038707e5bd0041580d6d

    • Size

      263KB

    • MD5

      4568b1dd6e36abce88bf98d024fb4380

    • SHA1

      1ce19a53caa0c37532d4e5beb06b3ebdf849efe1

    • SHA256

      a4d257c892f85dfc1d475cfc9c1029e0d65ceba6da70038707e5bd0041580d6d

    • SHA512

      992b3573997e871a694bac7ca570dc41eb924fad2184af220993baa849266f8bb97b748891cacabdd0afa1064bb63d17f683af3dc724f7aa151fce5382b082da

    • SSDEEP

      6144:Yp4nIghWPzAM6QgETd7z/ZnfdmRYHtFMeLSNwqdbsffd5Mc:YU27V5f4uHnMeIdIff8c

    • Modifies security service

    • Pony,Fareit

      Pony is a Remote Access Trojan application that steals information.

    • Disables taskbar notifications via registry modification

    • Executes dropped EXE

    • Modifies Installed Components in the registry

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v6

Tasks